Fijxu
/
nginx-quic
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Resolver: fixed use-after-free memory access. 

In 954867a2f0a6, we switched to using resolver node as the
timer event data, so make sure we do not free resolver node
memory until the corresponding timer is deleted.
This commit is contained in:
Ruslan Ermilov 2014-11-20 15:24:40 +03:00
parent 47a61270d1
commit 0f71123120
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/core/ngx_resolver.c
View File

@ -1568,8 +1568,6 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last,
ngx_rbtree_delete(&r->name_rbtree, &rn->node);
ngx_resolver_free_node(r, rn);
/* unlock name mutex */
while (next) {
@ -1580,6 +1578,8 @@ ngx_resolver_process_a(ngx_resolver_t *r, u_char *buf, size_t last,
ctx->handler(ctx);
}
ngx_resolver_free_node(r, rn);
return;
}
@ -2143,8 +2143,6 @@ valid:
ngx_rbtree_delete(tree, &rn->node);
ngx_resolver_free_node(r, rn);
/* unlock addr mutex */
while (next) {
@ -2155,6 +2153,8 @@ valid:
ctx->handler(ctx);
}
ngx_resolver_free_node(r, rn);
return;
}